ipv6 dns opcode: QUERY, status: REFUSED

[netgate_etagten]

;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 25153
;; flags: qr rd ad; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

Version 2.7.0-RELEASE (amd64)
built on Wed Jun 28 03:53:34 UTC 2023
FreeBSD 14.0-CURRENT

not fixxed by https://forum.netgate.com/topic/176989/problems-with-pfsense-ipv6-dns-function-does-it-exist

[johnpoz]

@netgate_etagten that was fixed in https://redmine.pfsense.org/issues/13851

And is listed as resolved, with a target of 2.7..

Are you saying your not seeing the ACL populated with IPv6 on your lan interface?

[netgate_etagten]

@johnpoz After reinstalling the system, I tested it and still failed. No other special services are available at this time.

After a reboot:

[johnpoz]

@netgate_etagten if your IPv6 is not allowed then yes it will be refused..

Let me fire up my 2.7 vm and put an IPv6 on it, and check the acl..

edit: did you restart unbound? Here see no IPv6 in access list, I then added one, then restarted unbound and there it is IPv6 prefix added to the access list

Now I could go through all the hassle of routing actual gua IPv6 to my VM running pfsense, but the issue is clearly its going to refuse if not in the access list, and a restart of unbound creates it.. A ula is fine in testing if the IPv6 prefix you have on your interface is added to the access list.

So it doesn't really matter past that, but here I can query it, when I put IPv6 on my box..

[netgate_etagten]

@johnpoz
Restarting unbound can fix it, but unbound is abnormal after system startup.

Sep 8 23:08:42 unbound 45594 [45594:0] info: start of service (unbound 1.17.1).

2023-09-08 23:08:36 dhcp6c 51544 failed to open /usr/local/etc/dhcp6cctlkey: No such file or directory
2023-09-08 23:08:36 dhcp6c 51544 failed initialize control message authentication
2023-09-08 23:08:36 dhcp6c 51544 skip opening control port
2023-09-08 23:08:37 dhcp6c 51649 Sending Solicit
2023-09-08 23:08:38 dhcp6c 51649 Sending Request
2023-09-08 23:08:38 dhcp6c 51649 dhcp6c Received REQUEST
2023-09-08 23:08:38 dhcp6c 51649 add an address 20:0:0:0:0:0:e8f:6be1/64 on re0
2023-09-08 23:08:38 dhcp6c 51649 status code for PD-0: success
2023-09-08 23:08:39 dhcp6c 51649 restarting
2023-09-08 23:08:39 dhcp6c 51649 Start address release
2023-09-08 23:08:39 dhcp6c 51649 Sending Release
2023-09-08 23:08:39 dhcp6c 51649 remove an address 20:0:0:0:0:0:e8f:6be1/64 on re0
2023-09-08 23:08:39 dhcp6c 51649 dhcp6c Received RELEASE
2023-09-08 23:08:39 dhcp6c 51649 status code: success
2023-09-08 23:08:40 dhcp6c 51649 Sending Solicit
2023-09-08 23:08:41 dhcp6c 51649 Sending Request
2023-09-08 23:08:41 dhcp6c 51649 dhcp6c Received REQUEST
2023-09-08 23:08:41 dhcp6c 51649 add an address 20:0:0:0:0:0:e8f:6be1/64 on re0
2023-09-08 23:08:41 dhcp6c 51649 status code for PD-0: success
2023-09-08 23:08:41 dhcp6c 51649 Sending Solicit
2023-09-08 23:08:42 dhcp6c 51649 advertise contains NoAddrsAvail status
2023-09-08 23:08:42 dhcp6c 51649 Sending Solicit
2023-09-08 23:08:43 dhcp6c 51649 advertise contains NoAddrsAvail status
2023-09-08 23:08:44 dhcp6c 51649 Sending Solicit
2023-09-08 23:08:45 dhcp6c 51649 advertise contains NoAddrsAvail status
2023-09-08 23:08:48 dhcp6c 51649 Sending Solicit
2023-09-08 23:08:49 dhcp6c 51649 advertise contains NoAddrsAvail status
2023-09-08 23:08:56 dhcp6c 51649 Sending Solicit
2023-09-08 23:08:56 dhcp6c 51649 advertise contains NoAddrsAvail status
2023-09-08 23:09:10 dhcp6c 51649 Sending Solicit
2023-09-08 23:09:11 dhcp6c 51649 advertise contains NoAddrsAvail status
2023-09-08 23:09:25 dhcp6c 51649 restarting
2023-09-08 23:09:25 dhcp6c 51649 Start address release
2023-09-08 23:09:25 dhcp6c 51649 Sending Release
2023-09-08 23:09:25 dhcp6c 51649 failed to remove an address on re0: Can't assign requested address
2023-09-08 23:09:25 dhcp6c 51649 dhcp6c Received RELEASE
2023-09-08 23:09:25 dhcp6c 51649 status code: success
2023-09-08 23:09:27 dhcp6c 51649 Sending Solicit
2023-09-08 23:09:28 dhcp6c 51649 Sending Request
2023-09-08 23:09:28 dhcp6c 51649 dhcp6c Received REQUEST
2023-09-08 23:09:28 dhcp6c 51649 add an address 20:0:0:0:0:0:e8f:6be1/64 on re0
2023-09-08 23:09:28 dhcp6c 51649 status code for PD-0: success
2023-09-08 23:09:30 dhcp6c 51649 Sending Solicit
2023-09-08 23:09:31 dhcp6c 51649 advertise contains NoAddrsAvail status
2023-09-08 23:09:31 dhcp6c 51649 Sending Solicit
2023-09-08 23:09:32 dhcp6c 51649 advertise contains NoAddrsAvail status
2023-09-08 23:09:34 dhcp6c 51649 Sending Solicit
2023-09-08 23:09:34 dhcp6c 51649 advertise contains NoAddrsAvail status
2023-09-08 23:09:38 dhcp6c 51649 Sending Solicit
2023-09-08 23:09:38 dhcp6c 51649 advertise contains NoAddrsAvail status
2023-09-08 23:09:47 dhcp6c 51649 Sending Solicit
2023-09-08 23:09:47 dhcp6c 51649 advertise contains NoAddrsAvail status
2023-09-08 23:10:06 dhcp6c 51649 Sending Solicit
2023-09-08 23:10:06 dhcp6c 51649 advertise contains NoAddrsAvail status
2023-09-08 23:10:42 dhcp6c 51649 Sending Solicit
2023-09-08 23:10:42 dhcp6c 51649 advertise contains NoAddrsAvail status
2023-09-08 23:11:52 dhcp6c 51649 Sending Solicit
2023-09-08 23:11:52 dhcp6c 51649 advertise contains NoAddrsAvail status
2023-09-08 23:13:42 dhcp6c 51649 Sending Solicit
2023-09-08 23:13:42 dhcp6c 51649 advertise contains NoAddrsAvail status
2023-09-08 23:15:41 dhcp6c 51649 Sending Solicit
2023-09-08 23:15:42 dhcp6c 51649 advertise contains NoAddrsAvail status
2023-09-08 23:17:49 dhcp6c 51649 Sending Solicit
2023-09-08 23:17:49 dhcp6c 51649 advertise contains NoAddrsAvail status
2023-09-08 23:19:54 dhcp6c 51649 Sending Solicit
2023-09-08 23:19:54 dhcp6c 51649 advertise contains NoAddrsAvail status

Why doesn't unbound use IPv6 Link Local?

[Gertjan]

@netgate_etagten

This page / log : Status > System Logs > System > DNS Resolver
as I presume you are looking for unbound logs in the DHCP logs, you won't find any.

[netgate_etagten]

@Gertjan I'm looking for lan ipv6 generation time

Sep 8 23:08:34 unbound 45594 [45594:0] notice: init module 0: validator
Sep 8 23:08:34 unbound 45594 [45594:0] notice: init module 1: iterator
Sep 8 23:08:34 unbound 45594 [45594:0] info: start of service (unbound 1.17.1).
Sep 8 23:08:41 unbound 45594 [45594:0] info: generate keytag query _ta-4f66. NULL IN
Sep 8 23:08:41 unbound 45594 [45594:1] info: generate keytag query _ta-4f66. NULL IN
Sep 8 23:08:42 unbound 45594 [45594:0] info: service stopped (unbound 1.17.1).
Sep 8 23:08:42 unbound 45594 [45594:0] info: server stats for thread 0: 1 queries, 0 answers from cache, 1 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Sep 8 23:08:42 unbound 45594 [45594:0] info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0
Sep 8 23:08:42 unbound 45594 [45594:0] info: server stats for thread 1: 6 queries, 0 answers from cache, 6 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Sep 8 23:08:42 unbound 45594 [45594:0] info: server stats for thread 1: requestlist max 2 avg 1.16667 exceeded 0 jostled 0
Sep 8 23:08:42 unbound 45594 [45594:0] notice: Restart of unbound 1.17.1.
Sep 8 23:08:42 unbound 45594 [45594:0] notice: init module 0: validator
Sep 8 23:08:42 unbound 45594 [45594:0] notice: init module 1: iterator
Sep 8 23:08:42 unbound 45594 [45594:0] info: start of service (unbound 1.17.1).
Sep 8 23:08:44 unbound 45594 [45594:0] info: generate keytag query _ta-4f66. NULL IN
Sep 8 23:08:44 unbound 45594 [45594:1] info: generate keytag query _ta-4f66. NULL IN
Sep 8 23:36:10 unbound 77967 [77967:0] notice: init module 0: validator
Sep 8 23:36:10 unbound 77967 [77967:0] notice: init module 1: iterator
Sep 8 23:36:10 unbound 77967 [77967:0] info: start of service (unbound 1.17.1).
Sep 8 23:36:15 unbound 77967 [77967:0] info: generate keytag query _ta-4f66. NULL IN

[johnpoz]

@netgate_etagten kind of hard to generate an IPv6 on your lan if you didn't get one on your wan..

advertise contains NoAddrsAvail status, or atleast your not getting a PD.

I take it you edited this to hide the actual IP your getting 20:0:0:0:0:0:e8f:6be1, cause that sure isn't valid ;)

[netgate_etagten]

@johnpoz
So I need to add the lan port ipv6 link local in unbound to ensure that it can work normally after the system restarts?

NoAddrsAvail because the acquired status is not released, and I don’t understand why dhcp6c needs to reacquire the address.

[johnpoz]

@netgate_etagten said in ipv6 dns opcode: QUERY, status: REFUSED:

why dhcp6c needs to reacquire the address.

Did you try setting this

https://docs.netgate.com/pfsense/en/latest/config/advanced-networking.html#do-not-allow-pd-address-release